# All Questions

18,648 questions
38 views

### Timestamps, sequence numbers, and nonces for replay attack

What are the best practices or standardized methods to prevent replay attacks in a simple server client setup (preferably where the server is stateless) ? When should timestamps, sequence numbers, ...
129 views

### Is it possible to brute force RC4 when you know the length of the key? [closed]

So I need to find out what the decrypted RC4 code. We are given the length of the key, and I want to know if there is a way to brute force it with this knowledge.
44 views

### Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
59 views

### What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
50 views

### What is the smallest size of the hash output?

Suppose we want to make the hash pre-image resistant to 40 bit security (success chance is $2^{−40}$). What would be the smallest size of the hash output?
31 views

### What do you mean when we say that a pseudorandom number generator is cryptographically secure? [duplicate]

I didn't get any good answers for this question
36 views

### I need help determining the best encryption options based on System.Security.Cryptography in .NET

I asked a question here, and received a great summary but was redirected here. Covering the answers of the post, it was noted and suggested that: Use of plain (CBC) mode. They suggested to use GCM ...
33 views

### What are the properties of Elliptical Curve Groups? [duplicate]

What is the difference between the $Z^{*}_{p}$ group and the elliptical curve group?
35 views

### AES, CMAC and “3 pass authentication protocol” Explained

I am struggling a bit to understand how authentication systems are properly used in NFC tag environments so I'm posting this thread to clarify some concepts.(In advance, this is not my field, so ...
42 views

### cryptographic hashing - tinyHMAC

Anette and Bernard are using the $\newcommand{\tH}{\operatorname{tinyHMAC}}\tH$ for protecting the integrity of communication. To reduce the success chance of the attacker, they are considering ...
51 views

### Overcome MD5-RSA Signature verification

I asked this question already at the Information Security SO site, but my research on how to overcome this problem ended always on the crypto site. That's why I will try to find some help here :) I ...
34 views

### deterministic uuidv4 -> uuidv4

I need to copy a graph of elements with uuidv4s each, and separately stored relations containing element uuidv4s. On copy, I ...
56 views

### Extract one unique SBox from Canonical Representative

In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an optimal class which named "Golden SBoxes". How can I ...
41 views

### ZKP: Asymmetric encryption with confidential message and known hash

I'm searching for a ZKP package that supports asymmetric encryption so I can implement following scenario : Carol encrypts message $m$ with Alice's public key and sends the ciphertext to Alice. Bob ...
21 views

### zero knowledge implementation supporting asymmetric encryption [closed]

Does anyone know any implementation of zero knowledge proofs implementation supporting asymmetric encryption? It doesn't make difference between RSA or ECDSA.
22 views

### Difference between one-way encryption, Transparent data encryption (TDE) and data encryption

What is the main difference between one-way encryption, Transparent data encryption (TDE) and data encryption? If one needs to store passwords or credit card details in the DB, which one is best to ...
49 views

### Example of product cipher more secure than its components

Can anyone give me an example of a product cipher which more secure than its components. Here is how the explanation should proceed. There is cipher C1 which can be attacked with the technique A1, ...
42 views

### is there any good idea that rabin rsa problem?

i study rabin asymmetric that p ≡ q ≡ 3mod4, when it decrypt Cipher Message, use Chinese remainder theorem and get four possibilities. my study book says that Receiver can choose m because he can ...
24 views

### How to decrypt sensitive information with a token and a password [migrated]

In a web app, it's common practice to encrypt sensitive information against a user's password. In this scenario, what's how would you access/encrypt/decrypt that information using token based ...
81 views

### What is the approximate effort to break one additional round of a primitive?

Many of the cryptographic primitives currently in use have a number of their rounds already broken. Generally and with no particular primitive in mind, what is the scale of the effort to break one ...
24 views

### what different between Interactive zero-knowledge proof and Non interactive zero-knowledge proof? [closed]

I'm trying to study the difference between Interactive and non-interactive zero knowledge proof of knowledge.I have known that in IZK proof is between prover and verifier so many time communicate and ...
45 views

### How you find the unpadded short plaintext using RSA?

I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.
38 views

### AES: Why ShiftRows() before MixColumns()? [duplicate]

In above picture you can see a AES state array over 2 rounds through the S- and P-Boxes of AES. It's taken from here and intends to show how 2 rounds of transformation are necessary to achieve full ...
15 views

### Hill Cipher if the length of the string is not divisible by the Key Dimensions

For a project, I want to encode the word "MEMBRANOPHONES" with the key "MULTITONE". I try spliting "MEMBRANOPHONES" into groups of 3, but then I get "MEM", "BRA", "NOP", "HON", leaving me with a 2 ...
1k views

### Does adding complexity mean a more secure cipher?

I have a cryptography workshop question I'm having trouble with as follows; Person A creates a cipher $E_k(m)$ which produces a ciphertext from message "m" using key "k". The function inside E is ...
19 views

### Round counts and permutation usage for hashing for a Merkle tree

Are there any current recommendations for performant hashing in a Merkle tree? It appears the hash based signatures in Sphincs use Blake2 everywhere (see Table 1 on page 22 of https://sphincs.cr.yp....
36 views

### Efficient universally composable protocols for aggregate statistics

Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value. An ideal functionality ...
50 views

### Proof of secure MAC [duplicate]

I'm studying about MAC and followings are definition of secure MAC. (This is Def 4.2 and Def 4.3 of "J.Katz and Y.Lindell-Introduction to Modern Cryptography") I want to prove this statement "There ...
39 views

### Bitcoin mining: how is a block header of 80 bytes processed in SHA-256? Isn't it too big?

The whole process of bitcoin mining was making sense to me until a moment of madness an hour ago, if there are 80 bytes of data to be processed in SHA-256, that's 640 bits of data to be processed in ...
23 views

### Are there any hash-based multisignature schemes?

Are there any hash-based signature schemes which would let two (or more) people sign the same message without increasing the size of the signature linearly? For my purposes, it is fine if the scheme ...
68 views

### The small key-search circuit for brute-force of Bernstein

I'm trying to understand Understanding brute force by Bernstein. I couldn't understand how the described machine can brute force the AES. The attacker builds a very small key-search circuit. The ...
131 views

### double encryption - One Time Pad

Can the security of the encryption system be improved by using double encryption with two randomly chosen keys? By double encryption I mean using two keys K1 and K2, each 20-bit long, to obtain ...
48 views

### Reverse Engineering Salted SHA1 Password Logic in SQL [closed]

I recently took over as an application administrator for an in-house developed app, an app which came with no documentation and no support. I found out my predecessor gave the exact same initial ...
72 views

### Converting EdDSA Keys to EC-KCDSA keys

I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation Can anyone tell me if there is a glaring problem with my conversion technique? ...
33 views

### LFSR expected period

What is the expected value of the length of the period of a n-bit linear-feedback shift register with a random tap? I am asking because I am curious what security issues would appear if the tap would ...
85 views

### What's the reason for Monte Carlo tests for block ciphers?

NIST specifies that implementations were required to create Monte Carlo test vectors for ECB and CBC mode for the AES competition. What's the reason for these tests? The only thing I can think of is ...
37 views

### Inconsistency with PKCS#11 v2.40 CKM_AES_KEY_WRAP_PAD

There appears to be some inconsistencies between the PKCS#11 v2.40 Current Mechanism Specification and the specification for AES Key Wrap Pad as defined in SP800-38F. First, according to PKCS#11: ...
50 views

### MD5: Existence of invariant (fixed point)

Is it possible to find 128 bits $B$ such that $md5(B) = B$? md5 has collisions that can be computed in acceptable time, but I did not find any papers on fixed points in md5. As pointed out in this ...
27 views

### Is it possible to encrypt a user’s email in a zero-knowledge way and still send them emails?

This is kind of hypothetical, but let’s say I have a web app and I want to store a user’s email for sending notifications to. Is there any zero-knowledge way to hide their email from ourselves and ...
96 views

### Origin of values for “security margin”?

It seems that the acceptable "security margin" for ciphers is set to be between 25% and 30% as a target by designers, where this number represents the number of rounds that remain "unbroken" for a ...
35 views

### Origin of the Chi-Squared test statistic for serial test (two bit test)

On page 181 of Handbook of Applied Cryptography Chapter Five, it states the following: The purpose of this test is to determine whether the number of occurrences of 00, 01, 10, and 11 as ...
37 views

### Reference for additive secret sharing

Regarding the secret sharing schemes, I am wondering if there are any academic references for the Additive Secret Sharing and its variations. Is there any textbook or article which has specifically ...
57 views

### Can we use fixed Beaver's multiplication triples many times?

In the secure computation based on GMW and SPDZ style approaches, we use multiplication triples to gain efficient online computation time. Can a same triples be used multiple times? Is there any need ...
39 views

### What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
67 views

### Block chain and storage issues

On reading about block chain technology, it was observed that it leverages the distributed ledger technology through P2P, here integrity is ensured through hash computed by miners, and then is ...
72 views

### Use a hash-function twice

I'm creating a small messenger and I wanted to know if it makes sense to store user passwords double-hashed in our backend-database. I wanted the user the register in an app, which should save a hash ...
129 views

Let $N=pq$ where $p$ and $q$ are safe primes. If the adversary knows the inverse of $p$ mod $q$ and the inverse of $q$ mod $p$, can this help him factor $N$ or break the textbook RSA?
58 views

### Is a random permutation “hiding”?

Let's say I tell you $G: \mathbb{F} \rightarrow \mathbb{F}$ is a random permutation (some finite field). Does that mean: $G$ is one-way, so that if I give you $G(x)$, it is infeasible to determine ...